[petsc-users] PETSc build asks for network connections

Pierre Jolivet pierre at joliv.et
Mon Mar 20 01:39:11 CDT 2023


> On 20 Mar 2023, at 2:45 AM, Barry Smith <bsmith at petsc.dev> wrote:
> 
> 
>   I found a bit more information in gmakefile.test which has the magic sauce used by make test to stop the firewall popups while running the test suite.
> 
> # MACOS FIREWALL HANDLING
> # - if run with MACOS_FIREWALL=1
> #   (automatically set in $PETSC_ARCH/lib/petsc/conf/petscvariables if configured --with-macos-firewall-rules),
> #   ensure mpiexec and test executable is on firewall list
> #
> ifeq ($(MACOS_FIREWALL),1)
> FW := /usr/libexec/ApplicationFirewall/socketfilterfw
> # There is no reliable realpath command in macOS without need for 3rd party tools like homebrew coreutils
> # Using Python's realpath seems like the most robust way here
> realpath-py = $(shell $(PYTHON) -c 'import os, sys; print(os.path.realpath(sys.argv[1]))' $(1))
> #
> define macos-firewall-register
>   @APP=$(call realpath-py, $(1)); \
>     if ! sudo -n true 2>/dev/null; then printf "Asking for sudo password to add new firewall rule for\n  $$APP\n"; fi; \
>     sudo $(FW) --remove $$APP --add $$APP --blockapp $$APP
> endef
> endif
> 
> and below. When building each executable it automatically calls socketfilterfw on that executable so it won't popup.
> 
> From this I think you can reverse engineer how to turn it off for your executables.
> 
> Perhaps PETSc's make ex1 etc should also apply this magic sauce, Pierre?

This configure option was added in https://gitlab.com/petsc/petsc/-/merge_requests/3131 but it never worked on my machines.
I just tried again this morning a make check with MACOS_FIREWALL=1, it’s asking for my password to register MPICH in the firewall, but the popups are still appearing afterwards.
That’s why I’ve never used that configure option and why I’m not sure if I can trust this code from makefile.test, but I’m probably being paranoid.
Prior to Ventura, when I was running the test suite, I manually disabled the firewall https://support.apple.com/en-gb/guide/mac-help/mh11783/12.0/mac/12.0
Apple has done yet again Apple things, and even if you disable the firewall on Ventura (https://support.apple.com/en-gb/guide/mac-help/mh11783/13.0/mac/13.0), the popups are still appearing.
Right now, I don’t have a solution, except for not using my machine while the test suite runs…
I don’t recall whether this has been mentioned by any of the other devs, but this is a completely harmless (though frustrating) message: MPI and/or PETSc cannot be used without an action from the user to allow others to get access to your machine.

Thanks,
Pierre

>> On Mar 19, 2023, at 8:10 PM, Amneet Bhalla <mail2amneet at gmail.com> wrote:
>> 
>> This helped only during the configure stage, and not during the check stage and during executing the application built on PETSc. Do you think it is because I built mpich locally and not with PETSc?
>> 
>> On Sun, Mar 19, 2023 at 3:51 PM Barry Smith <bsmith at petsc.dev <mailto:bsmith at petsc.dev>> wrote:
>>> 
>>>   ./configure option with-macos-firewall-rules
>>> 
>>> 
>>>> On Mar 19, 2023, at 5:25 PM, Amneet Bhalla <mail2amneet at gmail.com <mailto:mail2amneet at gmail.com>> wrote:
>>>> 
>>>> Yes, this is MPI that is triggering the apple firewall. If I allow it it gets added to the allowed list (see the screenshot) and it does not trigger the firewall again. However, this needs to be done for all executables (there will be several main2d's in the list). Any way to suppress it for all executables linked to mpi in the first place?
>>>> 
>>>> <Screenshot 2023-03-19 at 2.19.53 PM.png>
>>>> 
>>>> On Sun, Mar 19, 2023 at 11:01 AM Matthew Knepley <knepley at gmail.com <mailto:knepley at gmail.com>> wrote:
>>>>> On Sun, Mar 19, 2023 at 1:59 PM Amneet Bhalla <mail2amneet at gmail.com <mailto:mail2amneet at gmail.com>> wrote:
>>>>>> I'm building PETSc without mpi (I built mpich v 4.1.1 locally). Here is the configure command line that I used:
>>>>>> 
>>>>>> ./configure --CC=mpicc --CXX=mpicxx --FC=mpif90 --PETSC_ARCH=darwin-dbg --with-debugging=1 --download-hypre=1 --with-x=0
>>>>>> 
>>>>> 
>>>>> No, this uses MPI, it just does not built it. Configuring with --with-mpi=0 will shut off any use of MPI, which is what Satish thinks is bugging the firewall.
>>>>> 
>>>>>   Thanks,
>>>>> 
>>>>>     Matt
>>>>>  
>>>>>> On Sun, Mar 19, 2023 at 10:56 AM Satish Balay <balay at mcs.anl.gov <mailto:balay at mcs.anl.gov>> wrote:
>>>>>>> I think its due to some of the system calls from MPI.
>>>>>>> 
>>>>>>> You can verify this with a '--with-mpi=0' build.
>>>>>>> 
>>>>>>> I wonder if there is a way to build mpich or openmpi - that doesn't trigger Apple's firewall..
>>>>>>> 
>>>>>>> Satish
>>>>>>> 
>>>>>>> On Sun, 19 Mar 2023, Amneet Bhalla wrote:
>>>>>>> 
>>>>>>> > Hi Folks,
>>>>>>> > 
>>>>>>> > I'm trying to build PETSc on MacOS Ventura (Apple M2) with hypre. I'm using
>>>>>>> > the latest version (v3.18.5). During the configure and make check stage I
>>>>>>> > get a request about accepting network connections. The configure and check
>>>>>>> > proceeds without my input but the dialog box stays in place. Please see the
>>>>>>> > screenshot. I'm wondering if it is benign or something to be concerned
>>>>>>> > about? Do I need to accept any network certificate to not see this dialog
>>>>>>> > box?
>>>>>>> > 
>>>>>>> > Thanks,
>>>>>>> > 
>>>>>>> > 
>>>>>>> 
>>>>>> 
>>>>>> 
>>>>>> -- 
>>>>>> --Amneet 
>>>>>> 
>>>>>> 
>>>>>> 
>>>>> 
>>>>> 
>>>>> -- 
>>>>> What most experimenters take for granted before they begin their experiments is infinitely more interesting than any results to which their experiments lead.
>>>>> -- Norbert Wiener
>>>>> 
>>>>> https://www.cse.buffalo.edu/~knepley/ <http://www.cse.buffalo.edu/~knepley/>
>>>> 
>>>> 
>>>> -- 
>>>> --Amneet 
>>>> 
>>>> 
>>>> 
>>> 
>> 
>> 
>> -- 
>> --Amneet 
>> 
>> 
>> 
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mcs.anl.gov/pipermail/petsc-users/attachments/20230320/5466a251/attachment.html>


More information about the petsc-users mailing list